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(57) A system to detect the use of stolen mobile 
identification number (MIN) and electronic serial 
number (ESN) information to fraudulently place wireless 
calls by comparing the last phone number connected 
(LNC) as recorded by the radio telephone network (40) 
with the last phone number connected as recorded in 
the mobile radio telephone unit (10). The mobile radio 
telephone unit LNC is transmitted to the base station 
(1 2) upon initiation of a radio telephone call for compar- 
ison with the LNC recorded by the radio telephone net- 
work (40). The network will detect if a MIN/ESN combi- 
nation is in use by two different mobile units because 
the LNC of the two mobile units (1 0) will be different due 
to the different phone numbers called by each user. 
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Description 

The present invention relates to radio telephones, 
and more particularly to apparatus and method to detect 
and/or prevent unauthorized and fraudulent use of th9 s 
radio telephone. 

Wireless, radio telephones such as mobile phones 
are identified by a unique mobile identification number 
(MIN) and a unique electronic serial number (ESN). 
Both these identifying characteristics are transmitted »o 
over the air between the mobile phone and the tele- 
phone systems mobile switching center, and are there- 
fore able to be obtained by scanning equipment and il- 
legally used in another (clone) phone with the cost being 
charged to the owner of the original phone. »s 

A prior proposed solution to the illegal usage is to 
monitor the calling patterns for each customer's wireless 
calls and to block any calls that do not correspond to the 
customer's prior calling pattern. However, this solution 
may result in the blocking of calls for an authorized cus- *° 
tomer if they change their calling pattern, and it will not 
successfully block calls from phones that continually 
change the MIN-ESN that they use (so-called "tumbler- 
cloner" or "Magic phones". Also, typically the calling pat- 
tern can only be checked after the call is completed, at ss 
which time it is too late to prevent the fraud. 

Another prior solution to the problem is to utilize the 
IS 54 B Cellular System Dual-Mode Mobile Station -- 
Base Station Compatibility Standard (Rev-B). The IS 54 
8 standard calls for pre-call authentication of the calling 30 
wireless telephone using a 'shared secret key" over a 
digital call set-up channel. A shared secret key is a key 
that is known only by the two parties involved in the au- 
thentication. This proposed solution suffers from the 
problems that in order to be operative it requires both 35 
cooperation and investment on the part of all the wire- 
less carriers, such as the ability to access each other's 
data bases where the keys are stored and upgrading of 
their switching equipment to be compatible with the IS 
54 B call set standard. These propositions are compu- 40 
tationally intensive, expensive and require a long time 
to implement. 

Still another solution is the technique described in 
U.S. Patent 5,420,908 issued May 30, 1995 to Hodges 
et al. entitled METHOD AND APPARATUS FOR PRE- « 
VENTING WIRELESS FRAUD. In the Hodges et al. pat- 
ent the use of stolen mobile identification number (MIN) 
and electronic serial number (ESN) information to fraud- 
ulently place wireless calls is prevented by having the 
switches of multiple wireless carriers forward or direct, so 
over a telephone connection, all calls placed from se- 
lected MINs to a central authentication platform that 
serves the multiple wireless carriers. The central au- 
thentication platform engages in a so-called "challenge- 
response" authentication with local processors that are ss 
interfaced to the wireless telephones from which non- 
fraudulent calls originate. The challenge-response au- 
thentication uses a shared secret key (S-Key) that is not 



broadcast over the air interface, thus preventing the key 
from being "stolen". A call from a wireless telephone that 
is not interfaced to a local processor capable of success- 
fully completing the challenge-response authentication 
is completed to the number desired by the customer. Ad- 
vantageously, since the central authentication platform 
serves multiple wireless carriers, the need for one wire- 
less carrier to access the database of another is allevi- 
ated and the expense of providing additional security is 
reduced. 

The Hodges et al. technique is another example of 
a "shared secret data" technique that involves intensive 
compilation and relies on encryption techniques having 
algorithms that must be maintained secret. 

In the present invention, the use of stolen mobile 
identification number (MIN) and electronic serial 
number (ESN) information to fraudulently place wireless 
calls is detected by comparing the last phone number 
connected (LNC) as recorded by the radio telephone 
network with the last phone number connected as re- 
corded in the mobile radio telephone unit. The mobile 
un it LNC is transmitted to the base station upon initiation 
of a radio telephone call for comparison with the LNC 
recorded by the radio telephone network. The network 
will detect if a MIN/ESN combination is in use by two 
different mobile units because the LNC of the two mobile 
units will be different due to the different phone numbers 
called by each user. This method provides an advantage 
that no secret keys are needed, the effective signature 
of a mobile unit changes with each phone call made, 
and detection of fraudulent use is available within a few 
phone calls. 

According to one aspect of the present invention, 
there is provided a detection system for detecting the 
unauthorized use of a mobile radio telephone unit com- 
prising: 

at least one mobile radio telephone unit including: 

a first memory means for storing first numeric data 
representative of a last number connected (LNC); 

a first transceiver means for receiving and transmit- 
ting radio telephone communications; 

a first control means; 

a user interface means connected to said first con- 
trol means for inputting a telephone number by a 
user; 

said first control means coupled to said first trans- 
ceiver means for making and receiving radio tele- 
phone calls, and transmitting said inputted tele- 
phone number from said user interface means, said 
first control means further coupled to said first mem- 
ory means for recalling and transmitting said first 
numeric data representing a last telephone number 
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connected (LNC) and stored in said first memory 
means; 

a first processing means coupled to said first control 
means and to said first memory means for and re- s 
sponsive to said inputted telephone number from 
said user interface means and stored in said first 
memory means to form said first numeric data 
(LNC) representing a last number connected each 
time a radio telephone call occurs; 10 

a radio telephone network including 



at least one base stating including 

a second transceiver means for receiving and trans- 
mitting radiotelephone communications; 

a second control means to coupled to said second 
transceiver means for making and receiving radio 
telephone calls, said second control means further 
receiving from said second transceiver means said 
inputted telephone number and said first numeric 
data (LNC) transmitted from said at least one mo- 
bile radio telephone unit and received by said sec- 
ond transceiver means; 

a network communication means, coupled to said 
second control means, for connecting said at least 
one base station to said radio telephone network, 
said network communication means including; 

a second memory means for storing second numer- 
ic (LNC) data; 

a comparing means coupled to said second mem- 
ory means and to said second control means for 
comparing said second numeric (LNC) data stored 
and said first numeric data (LNC) received to gen- 
erate a comparison signal; 

a second processing means coupled to said second 
control means and to said second memory means 
and responsive to said inputted telephone number 
received from said at least one mobile radio tele- 
phone unit to form said second numeric data (LNC) 
which is stored in said second memory means each 
time a radio telephone call occurs 

wherein unauthorized use of said at least one mo- 
bile radio telephone unit is indicated by said com- 
parison signal when said second numeric data 
(LNC) stored in said network communication means 
is not the same as said first numeric data (LNC) re- 
ceived from said at least one mobile radiotelephone 
unit when a radio telephone call occurs. 

According to another aspect of the present inven- 
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tion, there is provided a method of detecting the unau- 
thorized use of a mobile radio telephone comprising: 

receiving at a mobile radio telephone network com- 
munications center a request for wireless telephone 
communication from a mobile radio telephone unit 
said request including a particular mobile identifica- 
tion number (MIN) data and electronic serial 
number (ESN) data for the mobile unit and last 
number connected (LNC) data from the mobile unit, 

receiving from the mobile unit a telephone number 
entered by a user; 

comparing said LNC data received from the mobile 
unit with LNC data previously stored in the network 
communications center for the mobile unit having 
said particular MINI/ESN data; 

responding to a difference indicated by the compar- 
ison of said LNC received and said LNC stored to 
indicate an unauthorized use of said mobile units. 



The present invention provides an apparatus and 
25 method that uses not only the Ml N and ESN but also the 
last number connected (LNC) by the mobile unit. 

Previous fraud detection techniques are static. 
Once the ESN of a legitimate mobile has been stolen, 
the original phone has been virtually cloned with no pos- 
30 sibility of detection until the customer receives his or her 
bill. 

The present invention provides a dynamically up- 
dated system of identifying a mobile. The dynamic var- 
iable is simply the last number which was dialed for 

35 which a phone call was completed by the mobile. This 
information is readily available both to the mobile and 
the base station. More significantly, it is ever changing 
through the regular use of the phone. 

In operation, when an attempt is made by a mobile 

*o to access the system, the system would not only ask for 
the usual MIN/ESN combination, but also for the last 
number the phone dialed and connected (LNC). An in- 
truder may manage to steal this information over the air, 
at the same time he steals the ESN/MIN. However, he 

4S now may only use this combination for as long as the 
original, legitimate user, does not make another call. 
Furthermore, as soon as the intruder has made a call, 
the first call placed by the legitimate user would trigger 
detection of dual usage of the same ESN. The course 

so of action at this point could vary in severity from covert 
observation and localization of the intruder to outright 
termination of the service with a message indicating the 
cause of the termination. The legitimate user would 
probably be grateful for not having to go through the 

ss process of proving that the several thousand dollars 
showing up on his bill are fraudulent, while the intruder 
would suffer the shock of having been detected. 

Other and further features, advantages and bene- 
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fits of the invention will become apparent in the following 
description taken in conjunction with the following draw- 
ings. It is to be understood that the foregoing general 
description and the following detailed description are ex- 
emplary and explanatory but are not to be restrictive of « 
the invention. 

The accompanying drawings which are incorporat- 
ed in and constitute a part of this invention and, together 
with the description, serve to explain the principles of 
the invention in general terms. 10 

In the drawings: 

Fig. 1 is a schematic illustration of a system for the 
detection of fraudulent use of a wireless radio telephone 
according to the principles of the present invention. 

Figs. 2 and 3 are illustrations of flow charts for a is 
method of fraud detection in wireless radio telephone 
systems according to the principles of the present in- 
vention. 

Referring to Fig. 1 , an illustration of an embodiment 
of a system for the detection of fraudulent use of a wire- so 
less telephone is provided including a mobile radio tel- 
ephone system. The mobile radio telephone system 
comprises at least one mobile unit 10 including a mem- 
ory means 14 for storing numeric data signal, a trans- 
ceiver means 1 6 for receiving and transmitting radio tel- 25 
ephone communication signals, a user interface means 
18 including a keypad 20 for inputting a telephone 
number and a display means 22 for displaying tele- 
phone numbers and other messages, and a control 
means 24 coupled to the user interface means 18. The so 
control means 24 is also coupled to the transceiver 
means 16 for making and receiving radio telephone 
calls, and for transmitting the present telephone number 
that the user input. The control means 24 is further cou- 
pled to the memory means 1 4 for recalling and transmit- 35 
ting a numeric data signal which represents the last tel- 
ephone number dialed and connected (LNC) and which 
is stored in the memory means 14. Memory means 14 
also has stored in it the MIN and ESN for the mobile unit 
10, and the MIN and ESN is also transmitted along with *o 
the numeric data signal. 

A processing means 26 is coupled to the control 
means 24 and to the memory means 1 4for manipulating 
an input telephone number to form the numeric data sig- 
nal which represents the last number connected and is 
which is stored in the memory means 14 each time a 
radiotelephone call occurs. The at least one mobile unit 
10 is connected through an air interface to at least one 
base station 1 2 that includes a transceiver means 30 for 
receiving and transmitting radio telephone communica- so 
tion signals and a control means 32 coupled to trans- 
ceiver means 30 for making and receiving radio tele- 
phone calls. The control means 32 further receives, from 
the transceiver means 30, the input telephone number 
and the numeric data signal (i.e. LNC) transmitted by ss 
the mobile unit 10 and received by the transceiver 
means 30 of base station 12 along with the MIN and 
ESN. An optional mobile switching center 42 is coupled 
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to the base station for interconnecting it to all base sta- 
tions in the system. A network communications center 
40 is provided, which may be located remote from base 
station 12, for example, by being connected to mobile 
switching center 42. Network communications center 
40, includes a memory means 46 for storing a numeric 
data signal, a comparing means 44 is coupled to mem- 
ory means 46 and also coupled to the base station, for 
example via mobile switching center 42 for comparing 
the numeric data signal (LNC) stored in memory means 
46 and the numeric data signal (LNC) transmitted by 
memory means 14 of mobile unit 10 to generate a com- 
parison signal on output 43. A processing means 50 is 
also coupled to control means 32 via mobile switching 
center 42 and to memory means 46 for manipulating the 
input telephone number received in a radio telephone 
communication from the mobile unit 10 to form a new or 
updated numeric data signal (LNC) which is stored In 
memory means 46 each time a radio telephone call oc- 
curs. An unauthorized use is indicated by the compari- 
son signal produced when the numeric data signal 
(LNC) stored in memory means 46 of the network com- 
munications center 40 is not the same as the numeric 
data signal (LNC) received from the memory means 14 
of mobile unit 10 via base station 12 when a radio tele- 
phone call occurs. 

When the output of comparing means 44 indicates 
that the two numeric data signals are not the same, the 
telephone call can be terminated or can be permitted to 
continue as desired. 

Referring to Fig. 2, a flow chart illustrates the steps 
of the method for carrying out the present invention. 

Referring to Fig. 2, an overview of the steps of the 
inventive method is presented in the flow chart. 

In block 60 the step of originating the mobile tele- 
phone call is performed. Then, in block 62, the step of 
fraud detection and updating the system parameters is 
carried out. Novel steps of the present invention are car- 
ried out essentially in block 62. After the step of block 
62 has been performed either the conversation is per- 
mitted to take place over the mobile phone (block 64) 
or, optionally, the call is terminated (block 66). 

If the conversation takes place according to block 
64, at the conclusion of the conversation the call ends 
(block 68). 

More particularly, Fig. 3 illustrates novel steps of the 
present invention. In the step of block 70 the fraud de- 
tection command is initiated. Then in the step of block 
72 the mobile phone transmits the electronic serial 
number (ESN), the mobile identification number (MIN) 
and the last number connected (LNC) data to the base 
station transceiver means 30 of Fig. 1. In block 74 the 
mobile phone transmits the dialed number to the base 
station transceiver means 30 of Fig. 1 . The ESN and the 
MIN are confirmed by the network communications 
center 40 and compare means 44 of Fig. 1 as shown in 
block 76 and the compare means 44 of network com- 
munications center 40 compares, as shown in block 78, 
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the LNC received from the mobile phone with the LNC 
stored in the network data base in memory means 46 of 
Fig. 1. 

If there is no match between the LNC received from 
the mobile phone unit 10 and the LNC from the data s 
base of memory means 46, then the "fraud detected" 
step of block 80 is carried out and, optionally, the call 
may be terminated (block 82) or proceed to complete 
the call (block 84). 

If there is a match between the LNC from the mobile 10 
phone unit 10 and the LNC from the data base of mem- 
ory means 46, then the "complete the call" step of block 
84 is carried out. 

In block 86, the data base stored in memory means 
46 is updated with the LNC of the dialed number trans- »s 
mitted from mobile phone unit 10 in block 74. 

Thus, upon the occurrence of another use of the 
mobile phone unit 1 0 with a new dialed number, the pre- 
viously dialed (connected) number is now the LNC 
stored in the data base of memory means 46. *° 

While the invention has been described in connec- 
tion with a preferred embodiment, it is not intended to 
limit the scope of the invention to the particular form set 
forth, but. on the contrary, it is intended to cover such 
alternatives, modifications, and equivalence as may be 25 
included within the scope of the invention as defined in 
the appended claims. 

Claims 30 

1. A detection system for detecting the unauthorized 
use of a mobile radio telephone unit comprising: 

at least one mobile radio telephone unit (1 0) in- as 
eluding: 

a first memory means (14) for storing first nu- 
meric data representative of a last number con- 
nected (LNC); 40 

a first transceiver means (1 6) for receiving and 
transmitting radio telephone communications; 

a first control means (24); 45 

a user interface means (18) connected to said 
first control means (24) for inputting a tele- 
phone number by a user; 

so 

said first control means (24) coupled to said first 
transceiver means (16) for making and receiv- 
ing radio telephone calls, and transmitting said 
inputted telephone number from said user in- 
terface means (18), said first control means S5 
(24) further coupled to said first memory means 
(14) for recalling and transmitting said first nu- 
meric data representing a last telephone 



number connected (LNC) and stored in said 
first memory means (14); 

a first processing means (26) coupled to said 
first control means (24) and to said first memory 
means (14) for and responsive to said inputted 
telephone number from said user interface 
means (18) and stored in said first memory 
means (14) to form said first numeric data 
(LNC) representing a last number connected 
each time a radio telephone call occurs; 

a radio telephone network including 

at least one base station (12) including 

a second transceiver means (30) for receiving 
and transmitting radio telephone communica- 
tions; 

a second control means (32) coupled to said 
second transceiver means (30) for making and 
receiving radio telephone calls, said second 
control means (32) further receiving from said 
second transceiver means (30) said inputted 
telephone number and said first numeric data 
(LNC) transmitted from said at least one mobile 
radio telephone unit (10) and received by said 
second transceiver means (30); 

a network communication means (40), coupled 
to said second control means (32), for connect- 
ing said at least one base station (12) to said 
radio telephone network, said network commu- 
nication means (40) including; 

a second memory means (46) for storing sec- 
ond numeric (LNC) data; 

a comparing means (44) coupled to said sec- 
ond memory means (46) and to said second 
control means (32) for comparing said second 
numeric (LNC) data stored and said first numer- 
ic data (LNC) received to generate a compari- 
son signal; 

a second processing means (50) coupled to 
said second control means (32) and to said sec- 
ond memory means (46) and responsive to said 
inputted telephone number received from said 
at least one mobile radiotelephone unit (10) to 
form said second numeric data (LNC) which is 
stored in said second memory means (50) each 
time a radio telephone call occurs; 

wherein unauthorized use of said at least one 
mobile radio telephone unit (1 0) is indicated by 
said comparison signal when said second nu- 
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meric data (LNC) stored in said network com- 
munication means (40) is not the same as said 
first numeric data (LNC) received from said at 
least one mobile radio telephone unit (1 0) when 
a radio telephone call occurs. * 

A detection system according to claim 1 wherein 
said radio telephone network includes a plurality of 
said base stations (12) and a mobile switching cent- 
er means (42) coupled to said second control 10 
means (32) of each of said base stations for con- 
necting said plurality of base stations (1 2) to each 
other. 

A detection system according to claim 1 or 2 where- is 
in said detection system includes a plurality of said 
mobile radio telephone units (10) each having 
stored therein separate, unique mobile identifica- 
tion number (MIN) data and electronic serial 
number (ESN) data, and wherein said MIN and ESN 20 
data is transmitted with said first numeric data 
(LNC). 

A detection system according to any preceding 
claim, wherein said user interface (18) includes an 2s 
alpha-numeric keypad (20) for inputting said tele- 
phone number by said user and a display means 
(22) for displaying alpha-numeric messages includ- 
ing telephone numbers. 

30 

A detection system according to any preceding 
claim further including means responsive to the out- 
put of said comparing means (44) for terminating 
said radio telephone call when said second numeric 
data (LNC) stored is not the same as said first nu- ss 
meric data (LNC) stored. 

A method of detecting the unauthorized use of a 
mobile radio telephone (10) comprising: 

AO 

receiving at a mobile radio telephone network 
communications center (40) a request for wire- 
less telephone communication from a mobile 
radiotelephone unit (10) said request including 
a particular mobile identification number (MIN) *s 
data and electronic serial number (ESN) data 
for the mobile unit (10) and last number con- 
nected (LNC) data from the mobile unit (10), 

receiving from the mobile unit (10) a telephone so 
number entered by a user, 

comparing said LNC data received from the 
mobile unit (10) with LNC data previously 
stored in the network communications center ss 
(40) for the mobile unit (10) having said partic- 
ular MIN/ESN data; 



responding to a difference indicated by the 
comparison of said LNC received and said LNC 
stored to indicate an unauthorized use of said 
mobile units (10). 

7. A method of detecting the unauthorized use of a 
mobile radiotelephone unit according to claim 6 fur- 
ther including, upon indication of authorised use; 

processing, in the network communications 
center (40), said telephone number entered by 
the user and received from said mobile un it (1 0) 
to create a new LNC data; 

storing, in the network communications center 
(40), said new LNC data created from the tele- 
phone number entered by the user and re- 
ceived from said mobile unit; 

processing in said mobile unit (10) the tele- 
phone number entered by said user to create 
said new LNC data; 

storing in the mobile unit the new LNC data cre- 
ated from the telephone number entered by the 

user. 

8. A method of detecting the unauthorized use of a 
mobile radio telephone unit according to claim 6 or 
7 wherein comparing the LNC data received from 
the mobile unit with that previously stored in the net- 
work communications center (40) further includes 
confirming the validity of the mobile identification 
number (MIN) data and the electronic number 
(ESN) data received from said mobile unit. 

9. A method as claimed in any of claims 6 to 8, further 
comprising: 

terminating a call upon detection of an unau- 
thorised use. 

10. A system for detecting the unauthorised use of the 
mobile identification number (MIN) and electronic 
serial number (ESN) of a radiotelephone (10), the 
system comprising: 

a radiotelephone (10) which transmits data rep- 
resentative of its last number connected (LNC) 
along with a call request; and 

a network communications center (40) for re- 
ceiving the call request, and which comprises: 

means (46) tor storing the LNC data for each 
MIN and ESN; and 

means (44) for comparing the LNC data from 
the radiotelephone (1 0) with the LNC data for 
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the given ESN and MIN and indicating unau- 
thorised use if they differ. 

11. A radio communications switching system for de- 
tecting the unauthorised use of the mobile identifi- s 
cation number (MIN) and electronic serial number 
(ESN) of a radiotelephone (10), the system com- 
prising: 

a receiver (30) for receiving a call request from to 
a radiotelephone (10), the call request includ- 
ing data representative of the last number con- 
nected (LNC) to that radiotelephone (10); 

means (46) for storing the LNC data for each is 
MIN and ESN; and 

means (44) for comparing the LNC data from 
the radiotelephone (10) with the LNC data for 
the given ESN and MIN and indicating unau- so 
thorised use if they differ. 

1 2. A method of detecting unauthorised use of the mo- 
bile identification number and electronic serial 
number of a radiotelephone (1 0), the method com- 
prising: 

forwarding a call request from the radiotele- 
phone (10) to a network communications cent- 
er (40), the call request including the radiotele- 30 
phone's (10) MIN, ESN and LNC data; and 

comparing the LNC data from the radiotele- 
phone (10) with LNC data stored in network 
communications center (40) for the particular 3S 
ESN and MIN and determining unauthorised 
use if the data differs. 
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